CVE-2021-39189

    Dashboard / Vulnerabilities / CVE-2021-39189

    CVE-2021-39189

    Published: 15 Sept 2021Last Modified: 7 Aug 2026

    Summary:

    Details: Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.

    References: https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9, https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c/, https://github.com/pimcore/pimcore/pull/10223.patch, https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dce

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -dd5e2a882ac846fb7207f17312e604ab8aec34f8

    Affected versions

    v10.1.2
    v10.1.1
    v10.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-39189 | CVE-DB